Terms of Service
Last updated: 2026-08-20. These terms define the operating boundary for approved cryptographic discovery, Airlock evidence, remediation workflow, and Trust Passport output.
Service
Morrow provides cryptographic discovery, post-quantum readiness analysis, Quantum Airlock evidence ingestion, remediation workflow, Trust Passport output, and compliance ledger reporting.
Authorization To Scan
You may use the service only on systems, repositories, domains, firmware, networks, and assets that you own or are explicitly authorized to assess. You are responsible for obtaining required approvals before scans, collectors, CI jobs, or middleware telemetry are enabled.
Acceptable Use
- Do not scan or attack systems without permission.
- Do not bypass authentication, authorization, rate limits, or tenant isolation.
- Do not upload malware, private keys, secrets, regulated records, or data you are not authorized to process.
- Do not use the service to violate law or customer agreements.
The free, no-account readiness check at /check is covered by its own terms of use and acceptable-use policy, because it is used by people who never create an account and it contacts hosts the requester may not own. If you operate a domain and do not want it checked there, use the opt-out.
Customer Data And Remediation
Customer data is handled according to the Privacy Policy and any signed DPA. The hosted service is free and there is no order form for it; where one exists it is because a deployment was arranged separately. The default product design does not require source code, private keys, secrets, raw packet payloads, or customer production records.
Remediation packages and PR outputs are recommendations or review-ready artifacts unless explicitly approved by authorized customer users.
The customer remains responsible for production change approval, testing, deployment, and rollback.
Disclaimers And Contact
The service does not guarantee regulatory compliance, complete cryptographic coverage, or elimination of post-quantum risk. Outputs depend on authorized scope, provided evidence, configured integrations, and customer environment limits.
Legal notices: send them through the support page, which names the address to use. The hosted service is free and there is no order form naming a different one.